Lucene search

K
cve[email protected]CVE-2022-2640
HistoryDec 02, 2022 - 8:15 p.m.

CVE-2022-2640

2022-12-0220:15:12
CWE-326
web.nvd.nist.gov
24
cve-2022-2640
horner automation
rcc 972
firmware
encryption
reverse engineering
credentials
ftp
http
vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.5%

The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).

Affected configurations

NVD
Node
hornerautomationrcc972Match-
AND
hornerautomationrcc972_firmwareMatch15.40

CNA Affected

[
  {
    "vendor": "Horner Automation",
    "product": "Remote Compact Controller (RCC) 972",
    "versions": [
      {
        "version": "Firmware Version 15.40",
        "status": "affected"
      }
    ]
  }
]

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.5%

Related for CVE-2022-2640